Security Advisory - 29th April 2021
Security Advisory: Potential for Unauthorised Access to Matillion Server
Matillion has released a hot fix for a security issue relating to our High Availability (HA) functionality that could allow an attacker to access credential data stored within Matillion ETL if executed from within your VPC.
It is unlikely that this vulnerability would have been exploited as it requires both access to the same VPC that is running a Matillion ETL instance, coupled with in-depth knowledge of the product. Matillion customers should upgrade to the latest security patch on the version identified below. This has been thoroughly tested on all platforms and is available now.
Matillion ETL makes use of Hazelcast for some of its HA functionality. The variant of Hazelcast used in older versions of Matillion ETL did not provide adequate protection for communication across a Hazelcast cluster or adequately authenticate new nodes to the cluster. As a result an attacker within the same VPC could join the cluster to query information available to Hazelcast such as access keys and credentials.
Due to the way that Matillion ETL is packaged, this issue affects all versions of ETL, regardless if HA functionality is currently deployed.
An attacker who was able to exploit this vulnerability would be able to access any configuration information shared between Hazelcast nodes such as secrets and credentials
Affected product and versions
Matillion ETL all versions prior to 1.53.10, 1.51.8 and 1.50.11
The vulnerability is fixed in all Matillion ETL products version 1.53.10 and newer. To remediate this vulnerability upgrade immediately
|Published Date||April 29, 2021|
|Vulnerability Type||Command Injection / Information Disclosure|
Overall Score 7.3
CVSS Rating High
CVSS V3 Vector